Palo Alto Networks PAN-NSG Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NSG Online Questions & Answers

• Question 71:

  What is the most efficient way in Strata Cloud Manager (SCM) to apply a Security policy to all ten firewalls in one data center?

  A. Create the Security policyon each firewall individually.
  B. Set the configuration scope to "Global" and create the Security policy.
  C. Create the Security policy at any configuration scope, thenclone it to the ten firewalls.
  D. Create a folder that groups the ten firewalls together, then createthe Security policy at thatconfiguration scope.
  D. Create a folder that groups the ten firewalls together, then createthe Security policy at thatconfiguration scope.

  ---

  Explanation

  InStrata Cloud Manager (SCM), the most efficient way to apply a Security policy to multiple firewalls in a single data center is to group the firewalls together into a folder and create the Security policy at that configuration scope. Grouping Firewalls: By organizing the ten firewalls into a folder, administrators can manage them as a single entity, reducing configuration time and ensuring consistency. Configuration Scope: SCM allows you to create policies at different scopes, such as Global, Device Group, or Folder level. By applying the policy at the folder scope, it is automatically propagated to all firewalls within the group.

  Efficiency: This approach eliminates the need to individually configure each firewall or manually clone policies, which can be time-consuming and error-prone.

  References:

  Strata Cloud Manager Policy Management

  Best Practices for Multi-Firewall Management

• Question 72:

  At a minimum, which action must be taken to ensure traffic coming from outside an organization to the DMZ can access the DMZ zone for a company using private IP address space?

  A. Configure static NAT for all incoming traffic.
  B. Create NAT policies on post-NAT addresses for all traffic destined for DMZ.
  C. Configure NAT policies on the pre-NAT addresses and post-NAT zone.
  D. Create policies only for pre-NAT addresses and any destination zone.
  C. Configure NAT policies on the pre-NAT addresses and post-NAT zone.

  ---

  Explanation

  When setting upNAT for inbound traffic to a DMZusingprivate IP addressing, the correct approach is to configure NAT policies on: Pre-NAT addresses - Refers to thepublic IP addressthat external users access. Post-NAT zone - Refers to theinternal (DMZ) zonewhere the private IP resides. This ensures thatinbound requests are translated correctlyfrom public to private addresses and that firewall policies can enforce access control.

  NAT Rules Must Use Pre-NAT Addresses

  The firewallprocesses NAT rules first, meaningfirewall security policies reference pre-NAT IPs.

  This ensures incoming traffic is properly matched before translation.

  Post-NAT Zone Ensures Correct Forwarding

  The destination zone must match the actual (post-NAT) zoneto allow correct security policy enforcement. (A) Configure Static NAT for All Incoming Traffic-Static NAT alone does not ensure correct security policy enforcement.

  Pre-NAT and post-NAT rules are still required for proper traffic flow.

  (B) Create NAT Policies on Post-NAT Addresses for All Traffic Destined for DMZ-Incorrect, as NAT policies arealways based on pre-NAT addresses. (D) Create Policies Only for Pre-NAT Addresses and Any Destination Zone-Firewall rules must match the correct post-NAT zoneto ensure proper traffic handling.

  Firewall Deployment - Ensures correct NAT configuration for public-to-private access.

  Security Policies - Policies must match pre-NAT IPs and post-NAT zones for proper enforcement.

  Why is Pre-NAT Address & Post-NAT Zone the Correct Choice?Other Answer Choices AnalysisReferences and Justification:Thus,Configuring NAT policies on Pre-NAT addresses and Post-NAT zone (C) is the correct answer, as it ensures proper NAT and security policy enforcement.

• Question 73:

  In which mode should an ION device be configured at a newly acquired site to allow site traffic to be audited without steering traffic?

  A. Access
  B. Control
  C. Disabled
  D. Analytics
  D. Analytics

  ---

  Explanation

  AnION device(used in Prisma SD-WAN) must be configured inAnalytics modeat a newly acquired site toaudit traffic without steering it. This mode allows administrators tomonitor network behaviorwithout activelymodifying traffic paths.

  Passively Observes Traffic

  The ION device monitors and logs site trafficfor analysis.

  No active controlover routing or traffic flow is applied.

  Useful for Network Auditing Before Full Deployment Analytics mode providesvisibility into site trafficbefore committing toSD-WAN policy changes. Helpsidentify optimization opportunitiesandtroubleshoot connectivitybefore enabling traffic steering. (A) Access Mode - Enablesactive routing and steeringof traffic, which isnot desiredfor passive auditing. (B) Control Mode-Actively controls traffic flowsand enforces policies, not suitable for observation-only setups. (C) Disabled Mode - The device would not functionin this mode, making it useless for traffic monitoring.

  Firewall Deployment - Prisma SD-WAN ION devices must be placed in Analytics mode for initial audits.

  Zero Trust Architectures - Helps assess security risks before enabling active controls.

  Why Analytics Mode is the Correct Choice?Other Answer Choices AnalysisReferences and Justification:Thus, Analytics Mode (D) is the correct answer, as it allows auditing of site traffic without traffic steering.

• Question 74:

  All branch sites in an organization have NGFWs running in production, and the organization wants to centralize its logs with Strata Logging Service.

  Which type of certificate is required to ensure connectivity from the NGFWs to Strata Logging Service?

  A. Device
  B. Server
  C. Root
  D. Intermediate CA
  C. Root

  ---

  Explanation

  Tocentralize logsfromNGFWs to the Strata Logging Service, aRoot Certificate Authority (Root CA) certificateis required to ensuresecure connectivitybetween firewalls and Palo Alto Networks' cloud-basedStrata Logging Service.

  Authenticates Firewall Connections - EnsuresNGFWs trust the Strata Logging Service.

  Enables Encrypted Communication - Protectslog integrity and confidentiality.

  Prevents Man-in-the-Middle Attacks - Ensuressecure TLS encryptionfor log transmission.

  A. Device# Incorrect, becauseDevice Certificates are used for firewall management authentication, notlog transmission to Strata Logging Service.

  B. Server# Incorrect, becauseServer Certificates authenticate service endpoints, butfirewalls need to trust a Root CA for secure logging connections.

  D. Intermediate CA# Incorrect, becauseIntermediate CA certificates are used for validating certificate chains, butfirewalls must trust the Root CA for establishing secure connections. Firewall Deployment - Ensuressecure log transmission to centralized services. Security Policies - Preventslog tampering and unauthorized access. VPN Configurations - EnsuresVPN logs are securely sent to the Strata Logging Service. Threat Prevention - Ensuresfirewall logs are analyzed for security threats. WildFire Integration - Logsmalware-related events to the cloud for analysis. Zero Trust Architectures - Ensuressecure logging of all network events. Why a Root Certificate is Required?Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#C. Root

• Question 75:

  A company wants to onboard a new SaaS application to SaaS Security Inline to protect users from phishing and command-and-control (C2) activity within that app.

  Which configuration is required on the NGFW or Prisma Access to enable SaaS Security Inline protections?

  A. Configure an Enterprise DLP profile and attach it only to email Security policies
  B. Enable DNS Security and disable URL Filtering to avoid overlapping functionality
  C. Identify the SaaS application with App-ID and apply Advanced URL Filtering and Advanced Threat Prevention profiles
  D. Configure SSL Inbound Inspection for the SaaS provider's public IP ranges
  C. Identify the SaaS application with App-ID and apply Advanced URL Filtering and Advanced Threat Prevention profiles

  ---

  Explanation

  SaaS Security Inline relies oninline inspectionof traffic destined to SaaS applications.

  App-ID with Advanced URL Filtering and Advanced Threat Prevention (C)

  App-IDidentifies the specific SaaS application in the traffic, even when using HTTPS.

  Advanced URL FilteringandAdvanced Threat Preventioninspect URLs and payloads forphishing, C2, and exploit activitywithin the SaaS application.

  These profiles integrate withSaaS Security Inline policesto enforce protections in real time.

  A. Enterprise DLP profile only for email Restricts protection to email traffic and does not coverSaaS web sessions.

  B. Enable DNS Security and disable URL Filtering DNS Security complementsbut doesnot replacethe need forURL and content inspectioninside SaaS apps.

  D. Configure SSL Inbound Inspection for the SaaS provider's public IP ranges SaaS apps areexternal services;SSL Forward Proxy, not inbound inspection, is used for outbound SaaS traffic. Firewall Deployment - SaaS-bound traffic is decrypted, classified, and inspected inline. Security Policies - CombineApp-ID, URL Filtering, Advanced Threat Prevention, and SaaS Security Inline controls. Threat Prevention - Detectsphishing links and C2 communicationembedded in SaaS app sessions.

• Question 76:

  How does Panorama improve reporting capabilities of an organization's next-generation firewall deployment?

  A. By aggregating and analyzing logs from multiple firewalls
  B. By automating all Security policy creations for multiple firewalls
  C. By pushing out all firewall policies from a single physical appliance
  D. By replacing the need forindividual firewall deployment
  A. By aggregating and analyzing logs from multiple firewalls

  ---

  Explanation

  Panoramais Palo Alto Networks'centralized management platformforNext-Generation Firewalls (NGFWs). One of its key functions is toaggregate and analyze logs from multiple firewalls, which significantly enhancesreporting and visibilityacross an organization's security infrastructure.

  Centralized Log Collection - Panorama collectslogs from multiple firewalls, allowing administrators to analyze security events holistically. Advanced Data Analytics - It providesrich visual reports, dashboards, and event correlationfor security trends, network traffic, and threat intelligence.

  Automated Log Forwarding - Logs can beforwarded to SIEM solutionsor stored forlong-term compliance auditing.

  Enhanced Threat Intelligence - Integrated withThreat Prevention and WildFire, Panorama correlates logs to detectmalware, intrusions, and suspicious activityacross multiple locations.

  B. By automating all Security policy creations for multiple firewalls.# Incorrect, becausewhile Panorama enables centralized policy management, it doesnot fully automate policy creation-administrators must still define and configure policies.

  C. By pushing out all firewall policies from a single physical appliance.# Incorrect, becausePanorama is available as a virtual appliance as well, not just a physical one. While itpushes security policies, its primary enhancement to reporting islog aggregation and analysis.

  D. By replacing the need for individual firewall deployment.# Incorrect, becausefirewalls are still requiredfor traffic enforcement and threat prevention. Panorama does not replace firewalls; itcentralizes their management and reporting. Firewall Deployment - Panorama providescentralized log analysisfor distributed NGFWs. Security Policies - Supportspolicy-based logging and compliance reporting. VPN Configurations - Provides visibility intoIPsec and GlobalProtect VPN logs. Threat Prevention - Enhances reporting formalware, intrusion attempts, and exploit detection. WildFire Integration - StoresWildFire malware detection logsfor forensic analysis. Zero Trust Architectures - Supports log-basedrisk assessment for Zero Trust implementations. How Panorama Improves Reporting Capabilities:Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#A. By aggregating and analyzing logs from multiple firewalls.

• Question 77:

  Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

  

  Which Security policy rule will allow traffic to flow to the web server?

  A. Untrust (any) to DMZ (10.1.1.100), web browsing -Allow
  B. Untrust (any) to Untrust (1.1.1.100), web browsing - Allow
  C. Untrust (any) to Untrust (10.1.1.100), web browsing -Allow
  D. Untrust (any) to DMZ (1.1.1.100), web browsing - Allow
  D. Untrust (any) to DMZ (1.1.1.100), web browsing - Allow

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

• Question 78:

  How are content updates downloaded and installed for Cloud NGFWs?

  A. Through the management console
  B. Through Panorama
  C. Automatically
  D. From the Customer Support Portal
  C. Automatically

  ---

  Explanation

  Cloud NGFWs receive content updates automaticallyas part ofcloud-native security services. The se updates include: Threat prevention updates(IPS, malware signatures).

  App-ID updatesto maintain accurate application identification.

  WildFire updatesfor new malware detection.

  A. Through the management console# The management console provides visibility and controls, butupdates are not manually downloaded from here-they are pushed automatically.

  B. Through Panorama# Panorama canmanage policies and configurations, butCloud NGFW updates are delivered automatically by Palo Alto Networks.

  D. From the Customer Support Portal# Customer Support Portal provides manual update downloads for on-prem firewalls, butCloud NGFW updates are handled automatically. Firewall Deployment - Cloud NGFW receivesautomatic threat and application updates. Security Policies - Ensures updatesare always in sync with the latest threat intelligence. VPN Configurations - EnsuresVPN security mechanisms stay updated. Threat Prevention - Maintainscontinuous security enforcementwithout requiring manual updates. WildFire Integration - Cloud NGFWs automaticallyreceive new malware signaturesfrom WildFire. Zero Trust Architectures - Ensurescontinuous enforcement of Zero Trust policieswith up-to-date security intelligence. Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answer is:#C. Automatically

• Question 79:

  A security engineer is configuring GlobalProtect for a workforce that alternates between working from home and in the office.

  Which configuration helps ensure that users in the office do not unnecessarily establish a GlobalProtect tunnel while remote users remain protected?

  A. Use internal gateways only and require users to always connect to VPN
  B. Enable external host detection and configure internal host detection to match the corporate network
  C. Disable internal gateways and force all traffic through an external gateway
  D. Configure split tunneling to send only SaaS traffic into the tunnel
  B. Enable external host detection and configure internal host detection to match the corporate network

  ---

  Explanation

  GlobalProtect useshost detectionto determine whether the user is on the internal network or remote.

  External and internal host detection (B)

  The agent checksfor a preconfigured internal hostor IP pattern that exists only on the corporate LAN.

  If the internal host is reachable,the agent assumes the user is on-premisesand doesnot form the VPN tunnel.

  If unreachable, the agentinitiates the tunnelto an external gateway for remote protection.

  A. Use internal gateways only and require users to always connect to VPN This forces VPN usage even on-site, causingunnecessary overhead and complexity.

  C. Disable internal gateways and force all traffic through an external gateway This design ignoresoffice vs. remote contextand may break internal routing patterns.

  D. Configure split tunneling to send only SaaS traffic into the tunnel Split tunneling optimizesbandwidth, but doesnot decide when the tunnel should be built. Firewall Deployment - GlobalProtect intelligently chooses internal or external gateways based on host detection. Security Policies - Different posture and access control can be applied to internal vs. remote users. Zero Trust Architectures - Ensures secure remote access while avoiding redundant on-premises tunnels.

• Question 80:

  An administrator has imported a pair of firewalls to Panorama under the same template stack. As a part of the template stack, the administrator wants to create a high availability (HA) template to be shared by the firewalls.

  Which dynamic component should the administrator use when setting the Peer HA1 IP address?

  A. Template stack
  B. Template variable
  C. Address object
  D. Dynamic Address Group
  B. Template variable

  ---

  Explanation

  When configuringHigh Availability (HA)settings inPanorama, administrators need to ensure that each firewall in the HA pair has a uniquePeer HA1 IP addresswhile using ashared template stack. This is achieved usingTemplate Variables, which allow dynamic configurations per firewall.

  Ensures Unique HA1 IP Addresses HA pairs requiretwo separate HA1 IP addresses(one per firewall). Usingtemplate variables, the administrator can assign different values to each firewallwithout creating separate templates.

  Template Variables Provide Flexibility

  Instead ofhardcodingHA1 IP addresses in the template, variables allow different firewalls to dynamically inherit unique values.

  This avoids duplication and ensures configuration scalability when managing multiple firewalls.

  (A) Template Stack - Defines the overall configuration hierarchy but doesnot provide dynamic IP assignment. (C) Address Object - Used forsecurity policies and NAT rules, not for HA configurations.

  (D) Dynamic Address Group - Primarily used forautomated security policies, not HA settings.

  Firewall Deployment - HA configurations require unique peer IPs, and template variables provide dynamic assignment.

  Panorama - Template variables enhance scalability and simplify HA configurations across multiple devices.

  Why Template Variable is the Correct Answer?Other

  Answer Choices AnalysisReferences and Justification: Thus,Template Variable (B) is the correct answer, as it allows dynamic peer HA1 IP assignment while using a shared template stack in Panorama.